@@ -11,6 +11,7 @@ import {
 } from '@/hooks/queries/organization-secrets'
 
 interface OrganizationSecretInputContextValue {
+  sourceKey: string
   isSaving: boolean
   save(variables: Record<string, string>): Promise<void>
 }
@@ -36,14 +37,28 @@ export function OrganizationSecretInputHost({
   const matchesOrganization = organizationContext?.organization.id === organizationId
   const sourceQuery = useOrganizationSecretSource(matchesOrganization ? organizationId : '')
   const mutation = useSaveOrganizationSecrets(organizationId)
+  const renderContent = (value: OrganizationSecretInputContextValue | null, status?: ReactNode) => (
+    <OrganizationSecretInputContext.Provider
+      key={`${organizationId}:${session?.user?.id ?? ''}`}
+      value={value}
+    >
+      <div className='space-y-3'>
+        {status}
+        {children}
+      </div>
+    </OrganizationSecretInputContext.Provider>
+  )
 
   if (!organizationContext || !matchesOrganization || !session?.user?.id)
-    return (
+    return renderContent(
+      null,
       <p role='status'>Open this request in an organization conversation to add Generic Secrets.</p>
     )
-  if (sourceQuery.isPending) return <p role='status'>Loading Generic Secrets…</p>
+  if (sourceQuery.isPending)
+    return renderContent(null, <p role='status'>Loading Generic Secrets…</p>)
   if (sourceQuery.isError)
-    return (
+    return renderContent(
+      null,
       <p role='status'>
         Could not load Generic Secrets.{' '}
         <button type='button' className='underline' onClick={() => void sourceQuery.refetch()}>
@@ -54,7 +69,8 @@ export function OrganizationSecretInputHost({
 
   const source = sourceQuery.data?.source
   if (!source)
-    return (
+    return renderContent(
+      null,
       <p role='status'>
         {organizationContext.viewer.isAdmin ? (
           <>
@@ -73,7 +89,10 @@ export function OrganizationSecretInputHost({
       </p>
     )
   if (source.mode === 'organization' && !organizationContext.viewer.isAdmin)
-    return <p role='status'>Ask an organization admin to add these shared Generic Secrets.</p>
+    return renderContent(
+      null,
+      <p role='status'>Ask an organization admin to add these shared Generic Secrets.</p>
+    )
 
   const save = async (variables: Record<string, string>) => {
     try {
@@ -84,8 +103,7 @@ export function OrganizationSecretInputHost({
         remove: [],
       })
     } catch (error) {
-      // The server compares this source under lock. Refreshing a changed source
-      // remounts the form below, discarding drafts instead of redirecting them.
+      /** The server compares this source under lock; a new source key invalidates its drafts. */
       if (error instanceof ApiClientError && (error.status === 409 || error.status === 404))
         await sourceQuery.refetch()
       throw error
@@ -94,12 +112,9 @@ export function OrganizationSecretInputHost({
     }
   }
 
-  return (
-    <OrganizationSecretInputContext.Provider
-      key={`${organizationId}:${session.user.id}:${source.id}:${source.mode}`}
-      value={{ save, isSaving: mutation.isPending }}
-    >
-      {children}
-    </OrganizationSecretInputContext.Provider>
-  )
+  return renderContent({
+    sourceKey: `${organizationId}:${session.user.id}:${source.id}:${source.mode}`,
+    save,
+    isSaving: mutation.isPending,
+  })
 }
@@ -16,6 +16,7 @@ const {
   mockParams,
   mockCredentialHost,
   mockOrganizationContext,
+  mockSession,
   mockRefetchPersonalEnvironment,
   mockRefetchWorkspaceCredentials,
   mockIsBrowserAgentAvailable,
@@ -29,6 +30,7 @@ const {
 } = vi.hoisted(() => ({
   mockParams: vi.fn(() => ({ workspaceId: 'workspace-1' })),
   mockOrganizationContext: vi.fn(() => null),
+  mockSession: vi.fn(() => ({ data: { user: { id: 'person' } } })),
   mockCredentialHost: vi.fn(({ children }: { children: ReactNode }) => children),
   mockUpdateWorkspaceCredential: vi.fn(async () => undefined),
   mockRefetchPersonalEnvironment: vi.fn(async () => ({ data: {} })),
@@ -69,7 +71,7 @@ vi.mock('next/navigation', () => ({
 }))
 
 vi.mock('@/lib/auth/auth-client', () => ({
-  useSession: () => ({ data: { user: { id: 'person' } } }),
+  useSession: mockSession,
 }))
 vi.mock('@/app/workspace/[workspaceId]/home/components/chat-surface-context', () => ({
   useChatSurface: () => ({
@@ -151,6 +153,7 @@ describe('CredentialDisplay link tag', () => {
     vi.clearAllMocks()
     mockParams.mockReturnValue({ workspaceId: 'workspace-1' })
     mockOrganizationContext.mockReturnValue(null)
+    mockSession.mockReturnValue({ data: { user: { id: 'person' } } })
     mockCredentialHost.mockImplementation(({ children }: { children: ReactNode }) => children)
     window.localStorage.clear()
     window.history.replaceState({}, '', '/workspace/workspace-1/chat/chat-1')
@@ -326,6 +329,170 @@ describe('CredentialDisplay link tag', () => {
       expect(fetch).not.toHaveBeenCalled()
     })
 
+    it.each(['restricted', 'missing'] as const)(
+      'keeps personal credentials usable when organization secrets are %s',
+      async (availability) => {
+        setSource(availability === 'missing' ? null : { id: 'source', mode: 'organization' })
+        mockOrganizationContext.mockReturnValue({
+          organization: { id: 'org', name: 'Example' },
+          viewer: { isAdmin: false },
+        } as never)
+        render([secret, { type: 'secret_input', name: 'PERSONAL_KEY', scope: 'personal' }])
+        expect(container.textContent).toContain('Ask an organization admin')
+        expect(container.querySelector('input[aria-label="SERVICE_API_KEY"]')).toBeNull()
+        enter('PERSONAL_KEY', 'personal-only')
+        await submit()
+        expect(mockSavePersonalEnvironment).toHaveBeenCalledExactlyOnceWith({
+          variables: { PERSONAL_KEY: 'personal-only' },
+        })
+        expect(fetch).not.toHaveBeenCalled()
+        expect(onContinue).toHaveBeenCalledWith(
+          'Credential setup submitted — {"integrations":[],"secrets":[{"name":"SERVICE_API_KEY","status":"skipped"},{"name":"PERSONAL_KEY","status":"saved"}]}'
+        )
+      }
+    )
+
+    it('preserves personal drafts while loading and changing the organization source', async () => {
+      vi.mocked(fetch).mockReturnValue(new Promise(() => {}))
+      render([secret, { type: 'secret_input', name: 'PERSONAL_KEY', scope: 'personal' }])
+      expect(container.textContent).toContain('Loading Generic Secrets')
+      enter('PERSONAL_KEY', 'personal-only')
+      await act(async () => {
+        setSource({ id: 'source', mode: 'member' })
+        await sleep(0)
+      })
+      expect(
+        container.querySelector<HTMLInputElement>('input[aria-label="PERSONAL_KEY"]')?.value
+      ).toBe('personal-only')
+      enter()
+      await act(async () => {
+        setSource({ id: 'replacement', mode: 'organization' })
+        await sleep(0)
+      })
+      expect(
+        container.querySelector<HTMLInputElement>('input[aria-label="SERVICE_API_KEY"]')?.value
+      ).toBe('')
+      await submit()
+      expect(mockSavePersonalEnvironment).toHaveBeenCalledExactlyOnceWith({
+        variables: { PERSONAL_KEY: 'personal-only' },
+      })
+      expect(
+        vi.mocked(fetch).mock.calls.filter(([, init]) => init?.method === 'PATCH')
+      ).toHaveLength(0)
+      expect(onContinue.mock.calls[0][0]).toContain('"name":"SERVICE_API_KEY","status":"skipped"')
+      expect(onContinue.mock.calls[0][0]).toContain('"name":"PERSONAL_KEY","status":"saved"')
+    })
+
+    it('keeps personal and integration controls visible when organization metadata fails', async () => {
+      vi.mocked(fetch).mockRejectedValue(new Error('Metadata unavailable'))
+      mockUseUserPermissionsContext.mockReturnValue({ canEdit: true })
+      render([
+        secret,
+        { type: 'secret_input', name: 'PERSONAL_KEY', scope: 'personal' },
+        {
+          type: 'link',
+          provider: 'slack',
+          value: 'https://example.test/connect?workspaceId=target',
+          workspaceId: 'target',
+          scope: 'organization',
+        },
+      ])
+      await act(async () => {
+        await queryClient.refetchQueries({ queryKey: organizationSecretKeys.source('org') })
+        await sleep(0)
+      })
+      expect(container.textContent).toContain('Could not load Generic Secrets')
+      expect(container.querySelector('input[aria-label="PERSONAL_KEY"]')).not.toBeNull()
+      expect(container.querySelector('input[aria-label="SERVICE_API_KEY"]')).toBeNull()
+      expect(
+        container.querySelector('a[href="https://example.test/connect?workspaceId=target"]')
+      ).not.toBeNull()
+    })
+
+    it('keeps organization recap rows after submission when no input host is mounted', () => {
+      act(() =>
+        root.render(
+          <QueryClientProvider client={queryClient}>
+            <SpecialTags
+              segment={{ type: 'credential', data: [secret] }}
+              requestMode='plan'
+              credentialSubmission={{
+                integrations: [],
+                secrets: [{ name: 'SERVICE_API_KEY', status: 'saved' }],
+              }}
+            />
+          </QueryClientProvider>
+        )
+      )
+      expect(container.textContent).toContain('SERVICE_API_KEY')
+      expect(container.textContent).toContain('Added')
+      expect(container.querySelector('input')).toBeNull()
+    })
+
+    it('clears every draft when the authenticated user changes', () => {
+      setSource({ id: 'source', mode: 'member' })
+      const data: CredentialItemData[] = [
+        secret,
+        { type: 'secret_input', name: 'PERSONAL_KEY', scope: 'personal' },
+      ]
+      render(data)
+      enter()
+      enter('PERSONAL_KEY', 'personal-only')
+      mockSession.mockReturnValue({ data: { user: { id: 'another-person' } } })
+      render(data)
+      expect(
+        container.querySelector<HTMLInputElement>('input[aria-label="SERVICE_API_KEY"]')?.value
+      ).toBe('')
+      expect(
+        container.querySelector<HTMLInputElement>('input[aria-label="PERSONAL_KEY"]')?.value
+      ).toBe('')
+    })
+
+    it('does not complete the new source with an old pending save or discard unrelated saved progress', async () => {
+      let finishSave: (response: Response) => void = () => {
+        throw new Error('Save not started')
+      }
+      vi.mocked(fetch).mockImplementationOnce(
+        () =>
+          new Promise<Response>((resolve) => {
+            finishSave = resolve
+          })
+      )
+      setSource({ id: 'source', mode: 'member' })
+      render([secret, { type: 'secret_input', name: 'PERSONAL_KEY', scope: 'personal' }])
+      enter()
+      enter('PERSONAL_KEY', 'personal-only')
+      act(() => {
+        Array.from(container.querySelectorAll('button'))
+          .find((button) => button.textContent === 'Submit')
+          ?.click()
+      })
+      await act(async () => {
+        await sleep(0)
+        setSource({ id: 'replacement', mode: 'organization' })
+        await sleep(0)
+      })
+      await act(async () => {
+        finishSave(new Response(JSON.stringify({ success: true }), { status: 200 }))
+        await sleep(0)
+      })
+      expect(onContinue).not.toHaveBeenCalled()
+      expect(
+        container.querySelector<HTMLInputElement>('input[aria-label="SERVICE_API_KEY"]')?.value
+      ).toBe('')
+      expect(container.querySelector('input[aria-label="PERSONAL_KEY"]')).toBeNull()
+      expect(container.textContent).toContain('PERSONAL_KEY')
+      expect(container.textContent).toContain('Added')
+      enter('SERVICE_API_KEY', 'new-source-only')
+      await submit()
+      expect(mockSavePersonalEnvironment).toHaveBeenCalledOnce()
+      expect(onContinue).toHaveBeenCalledOnce()
+      expect(JSON.parse(String(vi.mocked(fetch).mock.calls.at(-1)?.[1]?.body))).toMatchObject({
+        sourceId: 'replacement',
+        upsert: { SERVICE_API_KEY: 'new-source-only' },
+      })
+    })
+
     it('never renders organization inputs in Search mode or a workspace conversation', () => {
       setSource({ id: 'source', mode: 'organization' })
       render([secret], 'assistant')